Scheduling PCaps
I’m lazy. On a scale of 1-10, maybe around a 5-6 in terms of laziness. I’ll do things if they need to be done, but I don’t want to waste extra energy doing things when there’s an easier, lazier way to accomplish the same task. And that’s specifically what this post is about.
The task: Run a packet capture for roughly a day. Then stop the packet capture, save the pcap file, and start a new packet capture.
I’ve been going into the server room, sitting on the floor with the packet capture laptop, and doing this stop, save, restart process for about a week now. Its not a particularly painful process. But it can definitely benefit from improvement. (isn’t that the definition of improvement?)
Now let’s get to the fun part. First, ingredients: 1 PC with RJ45 port. 1 ethernet cable. Optional: 1 USB to RJ45 adapter. Another ethernet cable.
Prerequisites: You’ll need to already have a mirrored port on your switch. This is just about how to schedule the packet captures. Secondly, for the optional portion, you’ll need to configure a port on a switch, to use the RJ45 adapter for the PC to give it an IP you can manage it on.
Let’s look at the crontabs now:
05 12 * * * cd /root/pcap; /usr/bin/timeout 1435m /usr/sbin/tcpdump -i eno1 -w outfile 03 12 * * * cd /root/pcap; /bin/bash renameToToday.sh
Oh yeah, gotta set up this crontab as root. so sudo crontab -e. Now, as root, we change directory to the pcap directory, use the timeout command, run the following for 1435 minutes, which is 5 minutes short of 1 day. Run tcpdump on the eno1 interface and write the pcap output to the file: outfile.
This script would run from 12:05pm until noon the next day.
3 minutes of nothingness
Then go to the pcap directory again, and run the script renameToToday.sh
And that script looks like:
#!/bin/bash today=$(date +"%b%d") mv outfile $today.pcap
And since today is October 18th, it would rename the file outfile to Oct18.pcap
2 minutes later
start the packet capture again, writing to a file called outfile
